pstream 0.1.7 → 0.1.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 2afaa0231c97802387625086c64da95b5ce114c2
-  data.tar.gz: 6e187acbce7c6c027faafacdcf1cd732f63e9ecf
+  metadata.gz: 1ee81e7ea543491338bb800254b0b2cc4c0850c3
+  data.tar.gz: d877d6ff3c9deca5cc7b3ef7e07531e9e1f587de
 SHA512:
-  metadata.gz: becd5a9ac9389461223797903374a9b4d8d26384748bacd8f2d1bd4dbb512df26ed0b3a6d525d6407f36040dfb15c7230e52f188f5c26b62b2b504a2fcb832e1
-  data.tar.gz: 3a1f74c8c74442bb8b8a31743bdb2295b31686592d802a5992e5d1fadc4c9fd2d638719d598ddda6c40078f9a591b4c37daa2ac34062433a872160714da8b4d9
+  metadata.gz: f65be907ced9b779793e85607d5b0e7a80306d8527dd7981890c0585da482cd4ab35a2de2ede23aa53b5c73b3ed224ec02e20aa76bc6c6a7f4a5a42d23ee5447
+  data.tar.gz: 6cace69f3b2e5eaa02ffc81dffb7a90bda72cd9dfe6413547f532f4ed289916fa2ca92558853679a9e442e2858300963e456e7e75eb7e628f351641174f0cdca

data/bin/pstream

@@ -92,51 +92,23 @@ end
 options = parse(ARGV)
 
 begin
-    pstream = PStream.new(options["pcap"])
+    pstream = PStream.new(
+        options["pcap"],
+        !String.disable_colorization
+    )
 
     if (options["stream"])
-        pstream.get_stream(
+        puts pstream.get_stream(
             options["stream"].to_i,
             options["prot"]
-        ).contents.split("\n").each do |line|
-            m = line.match(/([0-9A-Fa-f]{8}) (.*) (.{17})/)
-            puts [
-                m[1].light_blue,
-                m[2].light_green,
-                m[3].white
-            ].join(" ")
-        end
+        ).to_s
     elsif (options["ciphers"])
-        puts pstream.ciphers
-    else
-        pstream.to_s.split("\n").each do |line|
-            case line
-            when /.*:$/
-                # Headers
-                puts line.white
-            when /<->/
-                # Streams
-                m = line.match(/([0-9]+) \| (.+) \| ([0-9]+ Frames)/)
-                puts [
-                    m[1].light_blue,
-                    m[2].light_green,
-                    m[3].light_white
-                ].join(" | ")
-            else
-                case line
-                when /Unknown/
-                    puts line.light_yellow
-                when /NULL|MD5|RC4|anon/
-                    # Bad cipher suites
-                    puts line.light_red
-                when /E?(EC)?DHE?|AES_256/
-                    # Great cipher suites
-                    puts line.light_green
-                else
-                    puts line.white
-                end
-            end
+        pstream.cipher_negotiations.each do |negotiation|
+            puts negotiation.to_s
         end
+    else
+        # Summarize
+        puts pstream.to_s
     end
 rescue PStream::Error => e
     $stderr.puts e.message.red

data/lib/pstream.rb

@@ -4,13 +4,115 @@ require "scoobydoo"
 class PStream
     attr_reader :streams
 
-    def ciphers
+    def cipher_negotiations
+        negotiations = Hash.new
+
         # List ciphers during ssl handshake
         out = %x(
             tshark -r #{@pcap} -Y ssl.handshake.ciphersuite -V 2>&1 \
-                | \grep -E "Internet Protocol|Hostname:|Cipher Suite"
+                | \grep -E "(Handshake|Internet) Prot|Cipher Suite"
         )
-        return out
+
+        negotiation = nil
+        hello = nil
+        out.split("\n").each do |line|
+            case line.gsub(/^ +/, "")
+            when /^Cipher Suite:/
+                m = line.match(/Cipher Suite: ([^ ]+) (.*)$/)
+                case hello
+                when "Client"
+                    case m[1]
+                    when "Unknown"
+                        negotiation.suites.push("#{m[1]} #{m[2]}")
+                    else
+                        negotiation.suites.push(m[1])
+                    end
+                when "Server"
+                    id = "#{negotiation.dst} <-> #{negotiation.src}"
+                    # Ignore partial handshakes that are server side
+                    # only
+                    if (negotiations[id])
+                        case m[1]
+                        when "Unknown"
+                            negotiations[id].suite = "#{m[1]} #{m[2]}"
+                        else
+                            negotiations[id].suite = m[1]
+                        end
+                    end
+                    negotiation = nil
+                end
+            when /^Cipher Suites Length:/
+                m = line.match(/Cipher Suites Length: ([0-9]+)$/)
+                negotiation.length = m[1].to_i
+            when /^Handshake Protocol:/
+                m = line.match(/Handshake Protocol: ([^ ]+) Hello$/)
+                hello = m[1]
+            when /^Internet Protocol Version/
+                if (negotiation)
+                    id = "#{negotiation.src} <-> #{negotiation.dst}"
+                    negotiations[id] = negotiation
+                end
+
+                m = line.gsub("Internet Protocol Version", "").match(
+                    /(4|6), Src: ([^,]+), Dst: (.*)$/
+                )
+
+                ipv = m[1]
+                src = m[2]
+                dst = m[3]
+
+                negotiation = PStream::CipherNegotiation.new(
+                    self,
+                    ipv,
+                    src,
+                    dst,
+                    @colorize
+                )
+            end
+        end
+
+        # Keep parital handshakes that are client side only
+        if (negotiation)
+            id = "#{negotiation.src} <-> #{negotiation.dst}"
+            negotiations[id] = negotiation
+        end
+
+        return negotiations.values
+    end
+
+    def colorize_cipher_suite(suite)
+        return suite if (!@colorize)
+
+        case suite
+        when /Unknown/
+            # Unknown
+            return suite.light_yellow
+        when /NULL|MD5|RC4|anon/
+            # Bad cipher suites
+            return suite.light_red
+        when /E?(EC)?DHE?|AES_256/
+            # Great cipher suites
+            return  suite.light_green
+        else
+            # Maybe OK
+            return  suite.light_white
+        end
+    end
+
+    def colorize_header(header)
+        return header if (!@colorize)
+        return header.light_cyan
+    end
+
+    def colorize_stream(stream)
+        if (!@colorize)
+            return "#{stream.id} | #{stream.desc} | #{stream.frames}"
+        end
+        return [
+            "#{stream.id}".light_blue,
+            stream.desc.light_green,
+            stream.frames.light_white
+        ].join(" | ")
     end
 
     def get_stream(stream, prot = "tcp")
@@ -60,7 +162,16 @@ class PStream
         count = 0
         out.split("\n").each do |line|
             desc, frames = line.split(" | ")
-            streams.push(Stream.new(@pcap, prot, count, desc, frames))
+            streams.push(
+                Stream.new(
+                    @pcap,
+                    prot,
+                    count,
+                    desc,
+                    frames,
+                    @colorize
+                )
+            )
             count += 1
         end
 
@@ -68,7 +179,9 @@ class PStream
     end
     private :get_streams
 
-    def initialize(pcap)
+    def initialize(pcap, colorize = false)
+        @colorize = colorize
+
         if (ScoobyDoo.where_are_you("tshark").nil?)
             raise PStream::Error::TsharkNotFound.new
         end
@@ -87,31 +200,23 @@ class PStream
         end
     end
 
-    def negotiated_ciphers
-        f = "ssl.handshake.ciphersuite && ssl.handshake.type == 2"
-        out = %x(
-            tshark -r #{@pcap} -Y "#{f}" -V 2>&1 | \
-                \grep -E "Cipher Suite:" | \
-                sed -r "s|^ +Cipher Suite: ||g" | sort -u
-        )
-        return out.split("\n")
-    end
-
     def summary
         ret = Array.new
 
         # List streams
         ["tcp", "udp"].each do |prot|
-            ret.push("#{prot} streams:")
-            @streams[prot].each do |s|
-                ret.push("#{s.id} | #{s.desc} | #{s.frames}")
+            ret.push(colorize_header("#{prot} streams:"))
+            @streams[prot].each do |stream|
+                ret.push(colorize_stream(stream))
             end
             ret.push("")
         end
 
         # List ciphers that were actually selected
-        ret.push("Ciphers in use:")
-        ret.concat(negotiated_ciphers)
+        ret.push(colorize_header("Ciphers in use:"))
+        cipher_negotiations.each do |negotiation|
+            ret.push(colorize_cipher_suite(negotiation.suite))
+        end
 
         return ret.join("\n")
     end
@@ -122,5 +227,6 @@ class PStream
     end
 end
 
+require "pstream/cipher_negotiation"
 require "pstream/error"
 require "pstream/stream"

data/lib/pstream/cipher_negotiation.rb

@@ -0,0 +1,56 @@
+class PStream::CipherNegotiation
+    attr_accessor :length
+    attr_accessor :suite
+    attr_accessor :suites
+
+    attr_reader :dst
+    attr_reader :ipv
+    attr_reader :pstream
+    attr_reader :src
+
+    def colorize_hosts(src, dst)
+        return "#{src} <-> #{dst}" if (!@colorize)
+        return "#{src} <-> #{dst}".light_cyan
+    end
+
+    def colorize_ipv(ipv)
+        return "IPv#{ipv}" if (!@colorize)
+        return "IPv#{ipv}".light_cyan
+    end
+
+    def colorize_selected_suite(suite)
+        return [
+            "Selected".light_blue,
+            @pstream.colorize_cipher_suite(suite),
+            "from:".light_blue
+        ].join(" ")
+    end
+
+    def initialize(pstream, ipv, src, dst, colorize)
+        @colorize = colorize
+        @dst = dst
+        @ipv = ipv
+        @length = nil
+        @pstream = pstream
+        @src = src
+        @suite = nil
+        @suites = Array.new
+    end
+
+    def summary
+        ret = Array.new
+        ret.push(
+            "#{colorize_ipv(@ipv)} #{colorize_hosts(@src, @dst)}"
+        )
+        ret.push("    #{colorize_selected_suite(@suite)}") if (@suite)
+        @suites.each do |suite|
+            ret.push("    #{@pstream.colorize_cipher_suite(suite)}")
+        end
+
+        return ret.join("\n")
+    end
+
+    def to_s
+        return summary
+    end
+end

data/lib/pstream/stream.rb

@@ -3,24 +3,51 @@ class PStream::Stream
     attr_reader :frames
     attr_reader :id
 
+    def colorize_address(address)
+        return address if (!@colorize)
+        return address.light_blue
+    end
+
+    def colorize_ascii(ascii)
+        return ascii if (!@colorize)
+        return ascii.light_white
+    end
+
+    def colorize_hex(hex)
+        return hex if (!@colorize)
+        return hex.light_green
+    end
+
     def contents
         case @prot
         when /^tcp$/i
-            id=@id
+            stream=@id
         when /^udp$/i
-            id=@desc.gsub(" <-> ", ",")
+            stream=@desc.gsub(" <-> ", ",")
         else
             raise PStream::Error::ProtocolNotSupported.new(@prot)
         end
 
-        out = %x(
-            tshark -r #{@pcap} -z follow,#{@prot},hex,#{id} | \
+        ret = Array.new
+        %x(
+            tshark -r #{@pcap} -z follow,#{@prot},hex,#{stream} | \
                  sed "s|^	||" | \grep -E "^[0-9A-Fa-f]{8}"
-        )
-        return out
+        ).split("\n").each do |line|
+            m = line.match(/([0-9A-Fa-f]{8}) (.*) (.{17})/)
+            ret.push(
+                [
+                    colorize_address(m[1]),
+                    colorize_hex(m[2]),
+                    colorize_ascii(m[3])
+                ].join(" ")
+            )
+        end
+
+        return ret.join("\n")
     end
 
-    def initialize(pcap, prot, id, desc, frames)
+    def initialize(pcap, prot, id, desc, frames, colorize = false)
+        @colorize = colorize
         @desc = desc
         @frames = frames
         @id = id

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pstream
 version: !ruby/object:Gem::Version
-  version: 0.1.7
+  version: 0.1.8
 platform: ruby
 authors:
 - Miles Whittaker
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-03-04 00:00:00.000000000 Z
+date: 2016-03-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: colorize
@@ -59,6 +59,7 @@ extra_rdoc_files: []
 files:
 - bin/pstream
 - lib/pstream.rb
+- lib/pstream/cipher_negotiation.rb
 - lib/pstream/error.rb
 - lib/pstream/error/pcap_not_found.rb
 - lib/pstream/error/pcap_not_readable.rb